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Why GAO Did This Study 

In fiscal year 2007, the Department 
of Homeland Security (DHS) 
obligated about $12 billion for 
acquisitions to support homeland 
security missions. DHS's major 
investments include Coast Guard 
ships and aircraft; border 
surveillance and screening 
equipment; nuclear detection 
equipment; and systems to track 
finances and human resources. In 
part to provide insight into the 
cost, schedule, and performance of 
these acquisitions, DHS established 
an investment review process in 
2003. However, concerns have been 
raised about how well the process 
has been implemented — 
particularly for large investments. 
GAO was asked to (1) evaluate 
DHS's implementation of the 
investment review process, and (2) 
assess DHS's integration of the 
investment review and budget 
processes to ensure major 
investments fulfill mission needs. 
GAO reviewed relevant documents, 
including those for 57 DHS major 
investments (investments with a 
value of at least $50 million) — 48 of 
which required department-level 
review through the second quarter 
of fiscal year 2008; and interviewed 
DHS headquarters and component 
officials. 



What GAO Recommends 



GAO is making several 
recommendations aimed at better 
ensuring DHS fully implements and 
adheres to its investment review 
process, including tracking major 
investments and better integrating 
oversight results with budget 
decisions. DHS generally concurred 
with these recommendations. 

To view the full product, including the scope 
and methodology, click on GAO-09-29. 
For more information, contact John Hutton at 
(202)512-4841 orhuttonj@gao.gov. 



What GAO Found 

While DHS's investment review process calls for executive decision making at 
key points in an investment's life cycle — including program authorization — 
the process has not provided the oversight needed to identify and address 
cost, schedule, and performance problems in its major investments. Poor 
implementation of the process is evidenced by the number of investments that 
did not adhere to the department's investment review policy — of DHS's 48 
major investments requiring milestone and annual reviews, 45 were not 
assessed in accordance with this policy. At least 14 of these investments have 
reported cost growth, schedule slips, or performance shortfalls. Poor 
implementation is largely the result of DHS's failure to ensure that its 
Investment Review Board (IRB) and Joint Requirements Council (JRC) — the 
department's major acquisition decision-making bodies — effectively carried 
out their oversight responsibilities and had the resources to do so. Regardless, 
when oversight boards met, DHS could not enforce IRB and JRC decisions 
because it did not track whether components took actions called for in these 
decisions. In addition, many major investments lacked basic acquisition 
documents necessary to inform the investment review process, such as 
program baselines, and two out of nine components — which manage a total of 
8 major investments — do not have required component-level processes in 
place. DHS has begun several efforts to address these shortcomings, including 
issuing an interim directive, to improve the investment review process. 

The investment review framework also integrates the budget process; 
however, budget decisions have been made in the absence of required 
oversight reviews and, as a result, DHS cannot ensure that annual funding 
decisions for its major investments make the best use of resources and 
address mission needs. GAO found almost a third of DHS's major investments 
received funding without having validated mission needs and requirements — 
which confirm a need is justified — and two-thirds did not have required life- 
cycle cost estimates. At the same time, DHS has not conducted regular 
reviews of its investment portfolios — broad categories of investments that are 
linked by similar missions — to ensure effective performance and minimize 
unintended duplication of effort for investments. Without validated 
requirements, life-cycle cost estimates, and regular portfolio reviews, DHS 
cannot ensure that its investment decisions are appropriate and will ultimately 
address capability gaps. In July 2008, 15 of the 57 DHS major investments 
reviewed by GAO were designated by the Office of Management and Budget 
as poorly planned and by DHS as poorly performing. 



DHS Major Investments Lacking Appropriate Oversight 


Applicable 

Oversight element investments 


Number lacking 
element 


Percent lacking 
element 


DHS review in accordance with policy 48 


45 


94 


Required information at key decision points 34 


27 


79 


Life-cycle cost estimate 57 


39 


68 



Source: GAO. 
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^ G A O 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



November 18, 2008 

The Honorable David E. Price 
Chairman 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

Dear Mr. Chairman, 

Since it was established in 2003, the Department of Homeland Security 
(DHS) has been responsible for integrating 22 federal agencies with 
disparate missions into one department. In fiscal year 2007, DHS obligated 
about $12 billion for acquisitions to support homeland security missions 
including responding to threats and hazards to the nation and ensuring 
safe and secure borders. DHS components and offices sponsor 
investments, and this portfolio 1 includes Coast Guard ships and aircraft; 
border surveillance and screening equipment; nuclear detection 
equipment; and systems to track finances and human resources. DHS 
plans to spend over $60 billion to acquire and sustain such investments. 

To help ensure these broad and complex acquisitions achieve the 
department's national security mission, DHS established two key 
processes in 2003: investment review and budgeting. Where the budget 
process is used to allocate resources for DHS acquisitions, the investment 
review process is intended to provide departmental insight at key points in 
an investment's life cycle to assess the cost, schedule, and performance of 
these acquisitions. However, concerns have been raised about how well 
the investment review process has been defined and implemented — 
particularly for large investments — to achieve successful acquisition 
outcomes. Weaknesses in the investment review process can have a 
rippling effect on the budget process because these reviews are expected 
to inform annual funding decisions for major investments. Since 2005, 
DHS has been revising the investment review process and identified 
completing this effort as a priority in its 2008 high-risk management plan. 2 



^HS major investments include those with a total acquisition cost of $50 million or above 
for noninformation technology investments or life-cycle costs greater than $100 million for 
information technology investments. 

2 DHS Integrated Strategy for High-risk Management (2008). 
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Over this period, we have made a series of recommendations to DHS 
aimed at strengthening its investment review process. 

Because of the large commitment of resources for these investments, you 
asked us to (1) evaluate DHS's implementation of the investment review 
process, and (2) assess DHS's integration of the investment review and 
budget processes to ensure major investments fulfill mission needs. 

To conduct our work, we reviewed relevant GAO and DHS Inspector 
General reports and DHS documents, such as management directives and 
investment oversight guidance provided to components. We reviewed 
decision memos and investment documents for all 57 level 1 and level 2 
major investments identified by DHS. We specifically determined the level 
of oversight provided for 48 of these major investments — those that 
required department-level review from fiscal year 2004 through the second 
quarter of fiscal year 2008. We compared DHS budget practices with GAO 
and Office of Management and Budget (OMB) guidance on capital 
programming principles. We also interviewed representatives of the Chief 
Procurement Office (CPO), Chief Financial Office (CFO) and Chief 
Information Office as well as nine DHS components and offices that 
manage major investments. We conducted this performance audit from 
September 2007 until November 2008 in accordance with generally 
accepted government auditing standards. Those standards require that we 
plan and perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. See appendix I for additional information on our scope and 
methodology. 



DHS has not effectively implemented or adhered to its investment review 
process, which calls for executive decision making at key points in an 
investment's life cycle — including program authorization — due to a lack of 
senior management officials' involvement as well as limited monitoring 
and resources; consequently, DHS has not provided the oversight needed 
to identify and address cost, schedule, and performance problems in its 
major investments. Of 48 major investments requiring milestone or annual 
reviews, 45 were not reviewed in accordance with the department's 
investment review policy, and 18 were not reviewed at all. Four of these 
investments have transitioned into a late acquisition phase — production 
and deployment — without any required reviews. Poor implementation is 
largely the result of DHS's inability to ensure that its Investment Review 



Results in Brief 
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Board (IRB) and Joint Requirements Council (JRC) — the department's 
major acquisition decision-making bodies — effectively carried out their 
oversight responsibilities and had sufficient resources such as personnel 
to support the oversight function. Over the past several years, IRB and JRC 
review activities did not keep pace with investments requiring review. 
Moreover, DHS could not enforce decisions that were reached because the 
department did not track whether components took the actions called for 
by the IRB, such as addressing program requirement and performance 
deficiencies. In addition, many major investments lacked required 
acquisition documents necessary to guide and measure program 
performance as well as inform the investment review process, such as 
program baselines and, of those, over a third had cost growth, schedule 
slips, or performance shortfalls from fiscal year 2007 through the second 
quarter of fiscal year 2008. We also found that two components that 
manage 8 major investments do not have required component-level review 
systems in place. DHS has recognized these shortcomings and in 2007 
began several efforts to clarify and better adhere to the investment review 
process and released an interim acquisition management directive in 
November 2008. 

The investment review framework also integrates the budget process; 
however, budget decisions have been made in the absence of oversight 
reviews and, as a result, DHS cannot ensure that annual funding decisions 
for its major investments make the best use of resources and address 
mission needs. DHS officials explained that linking budget decisions to 
investment oversight has been difficult due to the erratic investment 
review schedule and that budget reviews can be the only oversight 
provided. We found almost a third of DHS's 57 major investments received 
funding without having IRB or JRC validated mission needs and 
requirements — a milestone that confirms a need is justified. GAO, OMB, 
and commercial best practices underscore the need to validate 
requirements before allocating resources. In addition, two thirds of DHS 
major investments did not have required life-cycle cost estimates, which 
are essential to making informed budget decisions. At the same time, DHS 
has not conducted regular reviews of its investment portfolios — broad 
categories of investments that are linked by similar missions — to ensure 
effective performance and minimize unintended duplication of effort for 
proposed and ongoing investments. Without validated mission needs, life- 
cycle cost estimates, and regular portfolio reviews, DHS cannot ensure 
that its investments will ultimately address capability gaps and avoid 
funding unintended duplication of effort. As of July 2008, more than a 
quarter of DHS major investments were on both the OMB Management 
Watch List and list of high-risk projects with shortfalls, meaning that they 
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are both poorly planned and poorly performing. The DHS Undersecretary 
for Management has said that strengthening the links between investment 
review and budget decisions is a top priority. 

To improve investment oversight, we are recommending that the Secretary 
of Homeland Security take several actions to better ensure DHS and its 
components fully implement and adhere to the investment review process, 
including tracking major investments and better integrating oversight 
results with budget decisions. DHS generally concurred with our 
recommendations, citing actions taken and efforts under way to improve 
the investment review process. The department's comments are reprinted 
in appendix II. DHS components provided technical comments which 
were incorporated as appropriate and where supporting documentation 
was provided. 



Background DHS invests in a wide array of complex acquisitions to achieve its national 

" security mission. DHS components and offices sponsor investments to 

address mission capability gaps and are the end-users of the developed 
acquisitions. DHS has stated that the Undersecretary for Management, as 
the Chief Acquisition Officer, is responsible for acquisition policy. The 
purpose of DHS's investment review and budget processes are to provide 
oversight of these major investments. Specifically, DHS established the 
investment review process in 2003 to help protect its major investments by 
providing departmental oversight of major investments throughout their 
life cycles and to help ensure that funds allocated for investments through 
the budget process are being spent wisely, efficiently, and effectively. In 
2005, we reported that this process adopted many acquisition best 
practices that, if applied consistently, could help increase the chances for 
successful outcomes. 3 However, we noted that incorporating additional 
program reviews and knowledge deliverables into the process could better 
position DHS to make well-informed decisions. In 2007, we further 
reported that DHS had not fully defined and documented policies and 
procedures for investment management or fully implemented key 
practices needed to control its information technology (IT) investments. 4 



3 GAO, Homeland Security: Successes and Challenges in DHS's Efforts to Create an 
Effective Acquisition Organization, GAO-05-179 (Washington, D.C.: Mar. 29, 2005). 

4 GAO, Information Technology: DHS Needs to Fully Define and Implement Policies and 
Procedures for Effectively Managing Investments, GAO-07-424 (Washington, D.C.: Apr. 27, 
2007). 
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To strengthen DHS's investment management capability, we 
recommended that the department fully define and document project and 
portfolio-level policies and procedures and implement key control 
processes. In addition to the investment review process, the DHS budget 
process serves as the framework for decision making for ongoing and 
future DHS programs. The framework is cyclic, consisting of planning, 
programming, budgeting, and execution phases that examine existing 
program funding and link the funding to program performance to ensure 
funds are expended appropriately and that they produce the expected 
results and benefits. 

The investment review process framework manages investment risk 5 by 
developing an organized, comprehensive, and iterative approach to 
identifying; assessing; mitigating; and continuously tracking, controlling, 
and documenting risk tailored to each project. The investment review 
process has four main objectives: (1) identify investments that perform 
poorly, are behind schedule, are over budget, or that lack capability, so 
officials can identify and implement corrective actions; (2) integrate 
capital planning and investment control with resource allocation and 
investment management; (3) ensure that investment spending directly 
supports DHS's mission and identify duplicative efforts for consolidation; 
and (4) ensure that DHS conducts required management, oversight, 
control, reporting, and review for all major investments. 6 The process 
requires event-driven decision making by high-ranking executives at a 
number of key points in an investment's life cycle. The investment review 
process provides guidance to components for all DHS investments, but it 



5 DHS defines investment risk as a measure of the potential inability to achieve project 
objectives within defined cost and schedule constraints. It has two components: the 
probability of failing to achieve a particular outcome and the consequences or impact of 
failing to achieve that outcome. 

6 DHS Management Directive No. 1400, Investment Review Process, Draft Version 2.0 
(March 2006) (interim guidance pending formal clearance, hereafter referred to as DHS 
Management Directive No. 1400). 
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requires formal 7 department-level review and approval only for major 
investments — those that are categorized as level 1 or 2 (see table l). 8 



Table 1 : 


: Investment Review Levels and Approval Authorities 




Level 


Review/approval 


Acquisition costs 3 


Life cycle costs" 
(Applies only to IT 
Investments) 


1 


Investment Review Board 
(IRB) reviews and approves 


Greater than $100 million 


Greater than $200 
million 


2 


Joint Requirements Council 
(JRC) reviews and approves 


Between $50 million and 
$100 million 


Between $100 million 
and $200 million 



Source: DHS Management Directive No. 1400. 



"All costs for acquiring, by contract, interagency agreement, or for other funding instruments, supplies 
and/ or services for a designated investment through purchase or lease, whether the supplies are 
already in existence or must be created, developed, demonstrated, and evaluated, and without regard 
to the type of funds used, whether appropriated or nonappropriated. 

"The total cost to the federal government of acquiring, operating, supporting, and, if applicable, 
disposing of the items being acquired. 

The investment review process has two types of reviews: programmatic 
and portfolio. Programmatic reviews are held at specific milestones and 
require documentation and discussion commensurate with the 
investment's life cycle phase. These reviews contribute to the investment 
review goal of identifying investments that perform poorly, are behind 
schedule, are over budget, or that lack capability so officials can identify 
and implement corrective actions. Portfolio reviews are designed to 
identify efforts for consolidation and mission alignment by monitoring and 
assessing broad categories of investments that are linked by similar 
missions to ensure effective performance, minimization of overlapping 
functions, and proper funding. The IRB and JRC are responsible for 
reviewing, respectively, level 1 and level 2 investments at key milestone 
decision points, but no less than annually, and provide strategic guidance 
(see table 2). In addition to requiring department-level review, DHS policy 
directs component heads to conduct appropriate management and 



7 DHS Management Directive No. 1400 authorizes DHS and components to tailor investment 
reviews based on the level, type, risk, and complexity of the investment and its associated 
acquisition strategy. 

investments are categorized into one of four levels based on an investment's total 
acquisition costs, or total life cycle costs for IT investments. Investment levels determine 
the extent and scope of the required project and program management, the level of 
reporting requirements, and the review and approval authority. 
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oversight of investments and establish processes to manage approved 
investments at the component level. 9 



Table 2: DHS Investment Oversight Entities and Responsibilities 



Level of review Membership Examples of responsibilities 



Investment Review Board (IRB) 


Department 


Deputy Secretary (Chair) 

Under Secretary for Management (Vice 
Chair) 

Chief Financial Officer (CFO), Chief 
Procurement Officer (CPO), Chief 
Information Officer 

Office of the Secretary, Policy Office, 
Office of the General Counsel 

Director, Program Analysis and 
Evaluation (Executive Secretary) 

Chair, Joint Requirements Council 
(JRC) (Adjunct Member) 


Review, validate, and approve all level 1 
investments. 

Review and validate portfolio placement and 
alignment with the strategic mission. 

Provide strategic guidance for the JRC and 
programs. 


Joint Requirements Council (JRC) 


Department 


Chair appointed by the Deputy 
Secretary 


Provide milestone reviews and approvals of 
level 2 investments. 




Senior managers from each component • 
and DHS line of business, General 
Counsel designee 

Director, Program Analysis and 
Evaluation (Executive Secretary) 

• 


Manage investment portfolios, including 
determining portfolio structure for an 
investment, conducting portfolio reviews, and 
making portfolio-related recommendations to 
the IRB. 

Validate requirements through the Mission 
Needs Statements and review projects to 
identify cross-functional requirements and 
applications. 


Responsibility for the acquisition function at DHS is shared between the CPO and each 



DHS component head. Eight DHS components have internal procurement offices with a 
Head of Contracting Activity who reports directly to the component head and is 
accountable to the CPO. The eight components are: Coast Guard, Customs and Border 
Protection, Federal Emergency Management Agency, Federal Law Enforcement Training 
Center, Immigration and Customs Enforcement, Office of Procurement Operations, Secret 
Service, and Transportation Security Administration. The Head of Contracting Activity for 
each component has overall responsibility for the day-to-day management of the 
component's acquisition function. 
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Level of review 



Membership 



Examples of responsibilities 



Heads of components and offices 

Component • Chief Operating Officer from each • Approve all level 3 and 4 investments and 

component, for example: ensure they comply with DHS's investment 

Undersecretary, Administrator, Director, review requirements. 8 
Chief Operating Officer, or designee. . Establish processes and provide the requisite 

resources to manage approved investments 

adequately. 

Submit joint/consolidated investments through 
the investment review process. 



Source: DHS Management Directive No. 1400. 

"Level 3 investments have total acquisition costs between $5 million and $50 million or IT life cycle 
costs between $20 million and $100 million. Level 4 investments have acquisition costs less than $5 
million or IT life cycle costs less than $20 million. 



The investment review process has three broad life cycle stages, covering 
five investment phases and four decision points or milestones (see fig. 1). 
In the preacquisition stage, gaps are to be identified and capabilities to 
address them defined. In the first phase of the acquisition stage — concept 
and technology development — requirements are to be established and 
alternatives explored. In the next phase — capability development and 
demonstration — prototypes are to be developed. In the final acquisition 
phase, the assets are produced and deployed. With the high dollar 
thresholds and inherent risk of level 1 and level 2 investments, IRB or JRC 
approval at milestone decision points is important to ensure that major 
investment performance parameters and documentation are satisfactorily 
demonstrated before the investment transitions to the next acquisition 
phase. IRB and JRC milestone reviews are not required once an 
investment reaches the sustainment phase. 



Figure 1 : DHS Investment Review Process 



Decision 
points 

Investment 
phase 

Lifecycle 
phase 



Program 
authorization 



Altermative 
selection 



Project 
decision 



Predeployment 
decision 



Program 
initiation 


Concept and 
technology 
development 


Capability 
development and 
demonstration 


Production and 
deployment 


Operations and 
support 








Preacquisition 




Acquisition 




Sustainment 



Source: GAO presentation of DHS data. 
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As designed, knowledge developed during each investment phase is to be 
captured in key documents and is to build throughout the investment life 
cycle. Performing the disciplined analysis required at each phase is critical 
to achieving successful outcomes. The main goals of the first investment 
phase, program initiation, are to determine gaps in capabilities and then 
describe the capabilities to fill the gap — this information is then captured 
in the mission needs statement. If the mission needs statement is 
approved, the investment then moves to the concept and technology 
development phase, which focuses both on setting requirements and 
important baselines for managing the investment throughout its life cycle. 
A key step in this phase is translating needs into specific operational 
requirements, which are captured in the operational requirements 
document. Operational requirements provide a bridge between the 
functional requirements of the mission needs statement and the detailed 
technical requirements that form the basis of the performance 
specifications, which will ultimately govern development of the system. 
Once the program has developed its operational requirements document, 
it then uses these requirements to inform the development of its 
acquisition program baseline, a critical document that addresses the 
program's critical cost, schedule, and performance parameters and is 
expressed in measurable terms. See figure 2 for a description of the 
documents. 10 



10 DHS, Investment Management Handbook, Draft Version 0.14, (March 2006). 

Page 9 GAO-09-29 DHS Major Investment Oversight 



Figure 2: Traceability of Key Acquisition Documents 



Mission Needs 
Statement 

A formal description of 
the strategic need for an 
investment. It links the 
gap in mission capability 
to the investments that 
will fill that gap. 



The capability 
gap described in 
the mission 
needs statement 
is translated into 
system level 
performance 
capabilities to 
fill that gap. 



Operational Requirements 
Document 

Describes the operating 
environment, functions to be 
performed, the need for 
interoperability with other 
systems, and other 
requirements. It ultimately 
drives system performance 
and capability. 



The performance 
parameters in the 
operational 
requirements 
document are 
used to establish 
the performance 
baseline of the 
acquisition 
program baseline. 



Acquisition Program 
Baseline 

Used to measure project 
performance, it summarizes 
critical cost, schedule, and 
performance parameters, 
expressed in measurable, 
quantitative terms that must 
be met to accomplish the_ 
goals of the investment. 



Must trace directly back to the 
mission gap expressed in the 
mission needs statement and the 
requirements detailed in the 
operational requirements 
document. 



Source: GAO presentation of key acquisition documents. 



The department's budget policy has two main objectives: (1) articulate 
DHS goals and priorities, and (2) develop and implement a program 
structure and resource planning to accomplish DHS goals. 11 DHS uses the 
process to determine investment priorities and allocate resources each 
year. The budget process emphasizes the importance of ensuring 
investments expend funds appropriately and that investment performance 
produces the expected benefits or results. IRB decisions and guidance 
regarding new investments are to be reflected to the extent possible in any 
iteration of the budget as appropriate. The Office of the Chief Financial 
Officer (CFO) manages the budget process. 



H DHS Management Directive No. 1330, Planning, Programming, Budgeting, and 
Execution. 
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Lack of Adherence to 
the Investment 
Review Process Led 
to Oversight Being 
Seldom Applied to 
Support Successful 
Acquisition Outcomes 



DHS has not effectively implemented or adhered to its investment review 
process due to a lack of involvement by senior officials as well as limited 
resources and monitoring; consequently, DHS has not identified and 
addressed cost, schedule, and performance problems in many major 
investments. Poor implementation largely rests on DHS's inability to 
ensure that the IRB and JRC effectively carried out their oversight 
responsibilities. Of 48 major investments requiring department-level 
review, 12 45 were not reviewed in accordance with the department's 
investment review policy, and 18 were not reviewed at all. In the absence 
of IRB and JRC meetings, investment decisions were reached outside of 
the required review process. Moreover, when IRB meetings were held, 
DHS did not consistently enforce decisions that were reached because the 
department did not track whether components and offices took the 
actions required by the IRB. In addition, 27 major investments have not 
developed or received DHS approval for basic acquisition documents 
required to guide and measure the performance of program activities — and 
the investment review process. Of those, over a third reported cost, 
schedule, or performance breaches in fiscal year 2007 and second quarter 
fiscal year 2008. According to DHS representatives, acquisition 
management practices are still new to many components, and we found 24 
investments lacked certified program managers needed to develop basic 
acquisition documents. We found that two out of nine components do not 
have required component-level review processes to adequately manage 
their major investments. DHS has recognized these deficiencies and began 
efforts in 2007 to clarify and better adhere to the investment review 
process. 



Most Major Investments 
Lacked Required 
Departmental Reviews and 
Many of Those Exceeded 
Cost Estimates 



Of DHS's 48 major investments requiring department-level review between 
fiscal year 2004 and the second quarter of fiscal year 2008, only three had 
all milestone and annual reviews. Of the 39 level 1 investments requiring 
IRB review and approval 13 to proceed to the next acquisition phase, as of 
March 2008, 18 have never been reviewed by the IRB — 4 of which have 
already reached production and deployment. The remaining 21 level 1 
investments received at least one milestone or annual review through the 



DHS Management Directive No. 1400 provides that level 1 and level 2 programs will have 
reviews at milestone decision points but no less than yearly, depending upon the type and 
nature of the acquisition. 

"For level 1 investments, the IRB is the required review and approval authority to proceed 
to the next acquisition phase. 
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investment review process. None of the 9 level 2 investments had JRC 14 
review and approval. DHS policy provides that its major investments be 
reviewed no less than yearly. 15 However, in fiscal year 2007, the most 
recent year for which data were available, only 7 of the 48 required annual 
reviews were conducted. As a result, DHS lacked the information needed 
to address cost, schedule, and performance deficiencies — a problem we 
identified with over one-third of DHS's major investments between fiscal 
year 2007 and the second quarter of fiscal year 2008. In our prior work on 
the Department of Defense (DOD), we found that when such reviews are 
skipped or not fully implemented, programs build momentum and move 
toward product development with little if any early department-level 
assessment of the costs and feasibility. Committing to programs before 
they have this knowledge contributes to poor cost, schedule, and 
performance outcomes. 16 

DHS level 1 investments that were never reviewed through the IRB 
process include some of the department's largest investments with 
important national security objectives. For example, the Federal 
Emergency Management Agency's (FEMA) Consolidated Alert and 
Warning System, which has estimated life-cycle costs of $1.6 billion, 
includes programs to update the Emergency Alerting System and other 
closely related projects. In 2007, we reported that FEMA faces technical, 
training, and funding challenges to develop an integrated alert and warning 
system. 17 Customs and Border Protection's (CBP) Secure Freight Initiative, 
which has estimated life-cycle costs of $1.7 billion, is designed to test the 
feasibility of scanning 100 percent of U.S.-bound cargo containers with 
nonintrusive equipment and radiation detection equipment at foreign 
seaports. Earlier this year, we reported that the Secure Freight Initiative 
faces a number of challenges, including measuring performance outcomes, 
logistical feasibility of some aspects of the investment, and technological 



For level 2 investments, the JRC is the required review and approval authority to proceed 
to the next acquisition phase. 

15 DHS Management Directive No. 1400. 

16 GAO, Best Practices: An Integrated Portfolio Management Approach to Weapon System 
Investments Could Improve DOD's Acquisition Outcomes, GAO-07-388 (Washington, D.C.: 
Mar. 30, 2007). 

17 GAO, Emergency Preparedness: Current Emergency Alert System Has Limitations, and 
Development of a New Integrated System Will Be Challenging, GAO-07-411 (Washington, 
D.C.: Mar. 30, 2007). 
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issues. 18 While these two investments are still in the concept and 
technology development phase, other major investments that have not 
been reviewed are even further along in the investment life cycle — when 
problems become more costly to fix. For example, CBP's Western 
Hemisphere Travel Initiative, with estimated life-cycle costs of $886 
million, is in capability development and demonstration. The investment 
aims to improve technologies to identify fraudulent documentation at U.S. 
ports of entry. We recently reported that because key elements of planning 
for the investment's management and execution remain uncertain, DHS 
faces challenges deploying technology, and staffing and training officers to 
use it. 19 

Reviews of the 9 level 2 investments — those with acquisition costs 
between $50 million and $100 million, or $100 million to $200 million for 
information technology — were similarly lacking. While the JRC met 
periodically between fiscal years 2004 and 2006, senior officials stated that 
it did not make approval decisions about any level 2 investments. As a 
result, investments such as the following — which are all now in the 
operations and support phase — were not reviewed and approved by the 
JRC: 

• FEMA's Total Asset Visibility, which has $91 million in estimated life-cycle 
costs, aims to improve emergency response logistics in the areas of 
transportation, warehousing, and distribution. 

• Transportation and Security Administration's (TSA) Hazardous Threat 
Assessment Program, which has $181 million in estimated life-cycle costs, 
was developed to perform a security threat assessment on applicants for 
licenses to transport hazardous materials. 

• The National Protection and Programs Directorate's National Security and 
Emergency Preparedness investment, which has $1.8 billion in estimated 
life-cycle costs, aims to provide specially designed telecommunications 
services to the national security and emergency preparedness 
communities in the event of a disaster if conventional communication 
services are ineffective. 



GAO, Supply Chain Security: Challenges to Scanning 100 Percent of U.S. -Bound Cargo 
Containers, GAO-08-533T (Washington, D.C.: June 12, 2008). 

19 GAO, Homeland Security: DHS Has Taken Actions to Strengthen Border Security 
Programs and Operations, but Challenges Remain, GAO-08-542T (Washington, D.C.: Mar. 
6, 2008). 
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During 2006, the JRC stopped meeting altogether after the chair was 
assigned to other duties within the department. DHS representatives 
recognized that since the JRC stopped meeting in 2006, there has been no 
direction for requirements or oversight of level 2 investments at the 
department level and that strengthening the JRC is a top priority. In the 
meantime, oversight of level 2 investments has devolved to the 
components. 

Without the appropriate IRB and JRC milestone reviews, DHS loses the 
opportunity to identify and address cost, schedule, and performance 
problems and, thereby, minimize program risk. Fourteen of the 
investments that lacked appropriate review through IRB and JRC 
oversight experienced cost growth, schedule delays, and 
underperformance — some of which was substantial. At least 8 investments 
reported cost growth between fiscal year 2007 and the second quarter of 
fiscal year 2008 (see table 3). Other programs experienced schedule delays 
and underperformance. For example, CBP's Automated Commercial 
Environment program reported a 20 percent performance shortfall in the 
first quarter of fiscal year 2008. Moreover, we reported in July 2008 that 
the Coast Guard's Rescue 21 program changed its acquisition baseline or 
cost, schedule, and performance goals four times resulting in a total 182 
percent cost growth and 5-year schedule slip. 20 



GAO, Information Technology: OMB and Agencies Need to Improve Planning, 
Management, and Oversight of Projects Totaling Billions of Dollars, GAO-08-1051T 
(Washington, D.C.: July 31, 2008). 
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Table 3: DHS Major Investments That Reported Cost Growth from 


Fiscal Year 2007 


to the Second Quarter of Fiscal Year 2008 




Investment 


Cost growth 


Chief Information Office 


Infrastructure Transformation Program 


31 percent 


Coast Guard 


Rescue 21 


16 percent 3 


Customs and Border Protection (CBP) 


Border Patrol Facilities 


16 percent 


Consolidated Trusted Traveler Program 


23 percent 


Department of Homeland Security (DHS) 


Homeland Secure Data Network 


11 percent 


Federal Emergency Management Agency (FEMA) 


Disaster Management E-Government 


93 percent 


Immigration and Customs Enforcement (ICE) 


Detention and Removal Modernization 


8 percent 


Transportation Security Administration (TSA) 


Electronic Baggage Screening Program 


1 percent 



Source: GAO presentation of DHS data. 

"The Coast Guard reported that it subsequently made progress in reducing cost growth in the Rescue 
21 program. 



DHS has acknowledged that the IRB and JRC have not conducted 
oversight in accordance with DHS policy — largely because the process has 
depended on direct involvement and availability of high-level leadership as 
well as a lack of sufficient staff resources to organize the review meetings. 
According to DHS representatives, the Deputy Secretary was unavailable 
to commit to the time required to conduct reviews of all investments, so 
only some major investments were reviewed. Our prior work shows that 
this problem existed from the start. For example, in 2004, we reported that 
DHS was having difficulty bringing all of its information technology 
programs before the IRB in a timely manner. 21 We reported in 2005 that key 
stakeholders, such as the Chief Procurement Officer, did not receive 
materials in time to conduct a thorough review and provide meaningful 



GAO, Information Technology: OMB and Department of Homeland Security Investment 
Reviews, GAO-04-323 (Washington, D.C.: Feb. 10, 2004). 
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feedback prior to investment review meetings and recommended that DHS 
ensure that stakeholders, including CPO officials, have adequate time to 
review investment submissions and provide formal input to decision- 
making review boards. 22 Moreover, in 2007, we reported that DHS 
investment boards did not conduct regular investment reviews and control 
activities were not performed consistently across projects. 23 DHS Chief 
Procurement Office and Chief Financial Office representatives added that 
the process was not adequately staffed to conduct annual reviews of 
investments as required by the investment review policy. We have 
previously recommended that DHS provide adequate resources, including 
people, funding, and tools, for oversight of major investments. 24 A 2007 
DHS assessment of 37 major investments found that many investments are 
awaiting senior management review. For example, FEMA's major 
investment, the flood map modernization program, requested a key 
investment review decision meeting in 2004 that was subsequently 
scheduled and cancelled in 2006. As a result, the program proceeded from 
development to operations and support without IRB review or approval. 

Because of these limitations, alternative approaches to obtaining decisions 
were adopted. Numerous officials reported that rather than going through 
the formal investment review process, in some cases DHS component 
officials began to seek approval directly from the Deputy Secretary. For 
example, in November 2006, the DHS Inspector General reported on the 
CBP's Secure Border Initiative program, noting that the investment 
oversight processes were sidelined in the urgent pursuit of SBInet's 
aggressive schedule and that the IRB and JRC processes were bypassed 
and key decisions about the scope of the program and the acquisition 
strategy were made without rigorous review and analysis or 
transparency. 25 DHS officials indicated that some decisions were very 
informal, based on conversations with the Deputy Secretary and without 
input from other IRB members. In such cases, the investment review 
process was bypassed, including consideration of supporting reviews and 
recommendations. DHS CPO and CFO representatives said they did not 



22 See GAO, Homeland Security: Successes and Challenges in DHS's Efforts to Create an 
Effective Acquisition Organization, GAO-05-179 (Washington, D.C.: Mar. 29, 2005). 

23 GAO-07-424. 

24 GAO-07-424. 

25 Department of Homeland Security, Office of the Inspector General, Risk Management 
Advisory for the SBInet Program Initiation, OIG-07-07 (Washington, D.C.: Nov. 14, 2006). 



Page 16 



GAO-09-29 DHS Major Investment Oversight 



always know whether a decision had been made through this informal 
process. 



Many Programs Lack 
Required Cost, Schedule, 
and Performance Data 
Critical to Informing 
Investment Decisions 



DHS investment review policy requires programs to develop specific 
documentation that captures key knowledge needed to make informed 
investment decisions. 26 This approach is similar to DOD's, which requires 
adequate knowledge at critical milestones to reduce the risk associated 
with each phase of the investment's life cycle and enable program 
managers to deliver timely, affordable, quality products. 27 GAO's work on 
commercial best practices for major acquisitions has demonstrated that 
this approach, if effectively implemented, can significantly improve 
program outcomes. 2S Our prior work has found that inadequate attention 
to developing requirements results in requirements instability, which can 
ultimately cause cost escalation, schedule delays, and fewer end items. 



Many major DHS investments do not have basic acquisition information 
required by investment review policy to guide and measure the 
performance of program activities and the investment review process. In 
particular, mission needs statements, operational requirements 
documents, and acquisition program baselines establish capability gaps, 
requirements needed to address gaps, and cost, schedule, and 
performance parameters, respectively. As of March 2008, of the 57 level 1 
and 2 investments, 34 were in a phase that required all three documents, 
but 27 did not have or only provided an unapproved draft of one or more 
of these documents (see appendix III for the investments lacking these 
approved documents). Of the 27 investments, we found that over a third 
reported cost, schedule, or performance breaches between fiscal year 2007 
and second quarter fiscal year 2008. For example, the Infrastructure 
Transformation program, which did not have an approved operational 
requirements document or acquisition program baseline, reported being 
up to 19 percent behind schedule in 2007. In another instance, the 



26 DHS Management Directive No. 1400; DHS Investment Management Handbook, Draft 
version 0. 14, (March 2006). 

2 'See DOD, Department of Defense Directive Number 5000.1, The Defense Acquisition 
System (May 12, 2003); Department of Defense Instruction Number 5000.2, Operation of 
the Defense Acquisition System (May 12, 2003); Defense Acquisition Guidebook, Version 
1.0 (Oct. 17, 2004). 

28 GAO, Defense Acquisitions: Better Weapon Program Outcomes Require Discipline, 
Accountability, and Fundamental Changes in the Acquisition Environment, 
GAO-08-782T (Washington, D.C.: June 3, 2008). 
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Immigration and Customs Enforcement (ICE) Detention and removal 
modernization program, which also lacked an approved operational 
requirements document and acquisition program baseline, reported 
schedule slippage of about 20 percent. Without required development and 
review of key acquisition data, DHS cannot be sure that programs have 
mitigated risks to better ensure good outcomes. 

CPO representatives explained that department acquisition management 
practices are new to many DHS components. For most investments, CPO 
representatives said that program managers were not familiar with basic 
acquisition documents and investment oversight staff had to work with 
program managers to help them develop these documents prior to 
investment reviews. In addition, we found that in fiscal year 2007, 24 major 
investments did not have program managers certified by DHS as having 
the required knowledge and skills to oversee complex acquisition 
programs. 29 Moreover, other factors such as pressure to get programs up 
and running, additional external requirements, and technological 
challenges also impact the ability to successfully manage acquisitions to 
support good acquisition outcomes. At the same time, some component 
officials said that they received insufficient and inconsistent guidance 
regarding what information should be included in key acquisition 
documents. This issue is long-standing. For example, we reported in 2005 
that because of the small number of department oversight staff, only 
limited support was provided to programs to assist them in completing 
their submissions for oversight reviews. 30 In addition, component officials 
told us that key acquisition documents are sometimes approved at the 
component level but are not reviewed and approved at the department 
level. For example, TSA officials indicated that documents needed for the 
Secure Flight and Passenger Screening Programs were approved by TSA 
and submitted to DHS for approval, but no action was taken to review and 
approve them. 



Per DHS Management Directive No. 0782, Acquisition Certification Requirement for 
Program Managers, DHS Program Managers must be certified at a level commensurate 
with the responsibilities of the acquisition being managed or eligible for certification within 
18 months of designation. The DHS CPO may consider temporary waivers to training 
requirements in rare cases. 

30 See GAO, Homeland Security: Successes and Challenges in DHS's Efforts to Create an 
Effective Acquisition Organization, GAO-05-179 (Washington, D.C.: Mar. 29, 2005). 
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The investment reviews that have been conducted have not always 
provided the discipline needed to help ensure programs achieve cost, 
schedule, and performance goals — even when a review identified 
important deficiencies in an acquisition decision memorandum. DHS has 
not routinely followed up on whether specific actions required by 
acquisition decision memorandums to mitigate potential risks have been 
implemented. 

The IRB issued a 2004 acquisition decision memorandum approving the 
U.S. Visitor and Immigrant Status Indicator Technology (US- VISIT) — a 
program that aims to facilitate travel and trade — to move into the 
capability development and demonstration phase although the IRB found 
the investment's cost, schedule, and performance risk to be high. The 
memorandum stated that more clarity was needed on the program's end- 
state capability, benefits related to life-cycle costs, and how it planned to 
transition to the operations and support phase. We reported that in 2006 
DHS had yet to develop a comprehensive plan describing what the end- 
state capability would be, and how, when, and at what cost it would be 
delivered. 31 In a 2006 decision memorandum, the IRB again instructed US- 
VISIT to address the end-state capability, by requiring a comprehensive 
affordable exit plan for airports, seaports, and landports. We subsequently 
reported that, as of October 2007, US- VISIT had yet to establish critical 
investment management processes, such as effective project planning, 
requirements management, and financial management, which are required 
to ensure that program capabilities and expected mission outcomes are 
delivered on time and within budget. 32 In addition, DHS had not developed 
capability for the other half of US- VISIT, even though it had allocated 
about one-quarter of a billion dollars to this effort. 

In a May 2006 decision memorandum, the IRB directed the Cargo 
Advanced Automated Radiography System investment to develop within 6 
months an acquisition program baseline, a concept of operations, and an 
operational requirements document. It also called for the investment to be 
reviewed annually. As of the second quarter of fiscal year 2008, a baseline 
and the concept of operations had been drafted, according to program 
officials. However, an operational requirements document had not been 



Major Investments Move 
Forward without 
Addressing Deficiencies 
Identified in Reviews 



GAO, Homeland Security: U.S. Visitor and Immigration Status Program's Long- 
standing Lack of Strategic Direction and Management Controls Need to Be Addressed, 
GAO-07-1065 (Washington, D.C.: Aug. 31, 2007). 

32 GAO-08-542T. 
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developed even though a $1.3 billion contract had been awarded for the 
investment. In addition, the Cargo Advanced Automated Radiography 
System investment had not yet received a follow-on review by the IRB. In 
another example, in a December 2006 decision memorandum, the IRB 
directed ICE's major investment Automation and Modernization to update 
its acquisition program baseline, its cost-benefit analysis and its life-cycle 
cost analysis. Automation and Modernization has since updated its 
acquisition program baseline, but its cost analyses were last updated in 
2005. 

Current and former CPO and CFO representatives noted that staffing has 
not been sufficient to review investments in a timely manner and conduct 
follow-up to ensure decisions are implemented. They indicated that 
support was needed to undertake a number of functions, including: 
designing the investment review process, collecting and reviewing 
investment documentation, preparing analyses to support investment 
decisions, and organizing review meetings, as well as conducting follow-up 
for major investments. According to DHS representatives, from 2004 to 
2007 there were four full-time equivalent DHS employees plus support 
from four contractors to fulfill those responsibilities. Many acquisition 
decision memos provided specific deadlines for components to complete 
action items, but according to CPO and CFO representatives IRB action 
items were not tracked. Without follow-up, the IRB did not hold 
components and major investment program offices accountable for 
addressing oversight concerns. 



Component-Level Review 
Processes Are Not Fully 
Developed to Ensure That 
Major Investments Receive 
Oversight 



DHS's investment review process requires that component heads establish 
processes and provide the requisite resources to manage approved 
investments adequately. Component heads are also responsible for 
approving all level 3 and level 4 investments and ensuring they comply 
with DHS investment review submission requirements. In the absence of 
sufficient review at the department level, well-designed component-level 
processes are particularly critical to ensuring that investments receive 
some level of oversight. For example, CBP and TSA officials reported that 
they relied on their component investment review processes to ensure 
some level of oversight when the department did not review their 
investments. However, for the nine components we reviewed, two did not 
have a process in place and others had processes that were either in 
development or not focused on the entire investment life cycle. For 
example, the Domestic Nuclear Detection Office and the National 
Protection and Programs Directorate did not have a formal investment 
review process, meaning that in the absence of an IRB or JRC review, their 
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eight major investments received no formal review. While FEMA has a 
process to manage contract-related issues, its review process does not 
currently address the entire investment life cycle. According to CPO 
representatives, the department is working with components to ensure 
that components have a process in place to manage investments and to 
have them designate an acquisition officer who is accountable for major 
investments at the component level. 



Gaps in Oversight Have 
Prompted DHS to Clarify 
the Investment Review 
Process 



DHS has acknowledged that the investment review process has not been 
fully implemented. In fact, the process has been under revision since 2005. 
DHS has begun to make improvements to the planning, execution, and 
performance of major investments as initial steps to clarify and better 
adhere to the investment review process. To gain an understanding and 
awareness of DHS's major investments, in 2007 during the course of our 
review, the Undersecretary for Management undertook an assessment of 
37 major investments conducted under the CPO's direction. The 
assessment identified a range of systemic weaknesses in the 
implementation of its investment review process and in the process itself. 
The DHS assessment found 



• many level 1 investments await leadership decisions; 

• acquisition decision memos lack rigor; 

• a lack of follow-up and enforcement of oversight decisions; 

• inadequate technical support at the investment level; and 

• unclear accountability for acquisitions at the component level. 



Many of the deficiencies identified are consistent with our findings. For 
example, the DHS assessment of Citizenship and Immigration Services 
(CIS) found that investments were either missing, or using draft or 
unsigned versions of key investment management documents, limiting 
DHS's ability to measure the investments' performance. In one case, DHS 
found that the Verification Information Systems investment is poorly 
defined. In another case, DHS reported that CIS's investment 
Transformation was using draft and unsigned acquisition documents, 
including its mission needs statement, acquisition plan, and acquisition 
program baseline. In 2007, we reported that: CIS had not finalized its 
acquisition strategy for Transformation and cost estimates therefore 
remain uncertain, plans do not sufficiently discuss enterprise architecture 
alignment and expected project performance, and these gaps create risks 



Page 21 



GAO-09-29 DHS Major Investment Oversight 



that could undermine Transformation's success as it begins to implement 
its plans. 33 In addition, DHS found that CIS's investment Customer Service 
Web Portal did not have key investment management documents and that 
the investment's performance cannot be adequately assessed. Similarly, 
DHS found that CIS's investment Integrated Document Production did not 
have performance measures or documentation that performance metrics 
have been implemented to measure program cost, schedule, and 
performance execution. 

To address the findings of its 2007 review, DHS is taking steps to reiterate 
the DHS investment review policy and establish a more disciplined and 
comprehensive investment review process. Beginning in February 2008, 
interim policies were issued by the Undersecretary for Management to 
improve management of major investments pending release of a new 
investment review management directive. Specifically, the Undersecretary 
for Management issued a memorandum in February 2008 on initiating 
efforts to improve the quality of acquisition program baselines for level 1 
investments, and another in July 2008 on improving life-cycle cost 
estimating for major investments. To help address the backlog of 
investments awaiting review, the CPO has begun to review and issue 
acquisition decision memorandums for each level 1 program. As of August 
2008, acquisition decision memorandums had been completed for three 
programs. The memorandums indicate documentation that must be 
completed, issues that must be addressed, and related completion dates 
before investment approval is given. The memorandums also identify any 
limits or restrictions on the program until those actions are completed. 
Further, the Undersecretary for Management signed an interim acquisition 
management directive in November 2008 to improve acquisition 
management and oversight pending results from a formal DHS executive 
review. 



' GAO, USCIS Transformation: Improvements to Performance, Human Capital, and 
Information Technology Management Needed as Modernization Proceeds, GAO-07-1013R 
(Washington, D.C.: July 17, 2007). 
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DHS's Investment 
Review and Budget 
Processes Are Not 
Integrated to Help 
Ensure That Major 
Investments Maximize 
Resources to Meet 
Mission Needs 



DHS's annual budget process for funding major investments has not been 
appropriately informed by the investment review process — largely 
because the IRB seldom conducts oversight reviews and when it has, the 
two processes have not been aligned to better ensure funding decisions 
fulfill mission needs. While DHS's investment review framework integrates 
the two processes — an approach similarly prescribed by GAO and OMB 
capital planning principles — many major investments received funding 
without determining that mission needs and requirements were justified. 
In addition, two-thirds of DHS major investments did not have required 
life-cycle cost estimates, which are essential to making informed budget 
and capital planning decisions. At the same time, DHS has not conducted 
regular reviews of its investment portfolios — broad categories of 
investments — to ensure effective performance and minimize unintended 
duplication of effort for proposed and ongoing investments. In July 2008, 
more than one-quarter of DHS's major investments were designated by 
OMB as poorly planned and by DHS as poorly performing. The DHS 
Undersecretary for Management has said that strengthening the links 
between investment review and budget decisions is a top priority. 



GAO and OMB Capital 
Planning Principles 
Emphasize an Integrated 
Investment Approach to 
Manage Risk and Costs 



OMB and GAO capital planning principles underscore the importance of a 
disciplined decision making and requirements process as the basis to 
ensure that investments succeed with minimal risk and lowest life-cycle 
cost. 34 This process should provide agency management with accurate 
information on acquisition and life-cycle costs, schedules, and 
performance of current and proposed capital assets. The OMB Capital 
Programming Guide also stresses the need for agencies to develop 
processes for making investment decisions that deliver the right amount of 
funds to the right projects. 



In addition, OMB and GAO guidance provide that an investment review 
policy should seek to use long-range planning and a disciplined, integrated 
budget process for portfolio management to achieve performance goals at 
the lowest life-cycle cost and least risk to the taxpayer and the 
government. Investment portfolios are integrated, agencywide collections 
of investments that are assessed and managed collectively based on 
common criteria. Managing investments as portfolios is a conscious, 



GAO, Executive Guide: Leading Practices in Capital Decision-Making, 
GAO/AIMD-99-32 (Washington D.C.: December 1998). OMB, Capital Programming Guide: 
Supplement to Circular A-ll, Part 7, Preparation, Submission, and Execution of the 
Budget (Washington, D.C.: Executive Office of the President, June 2006). 
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continuous, and proactive approach to allocating limited resources among 
an organization's competing initiatives in light of the relative benefits 
expected from these investments. Our prior work at DOD has shown that 
fragmented decision-making processes do not allow for a portfolio 
management approach to make investment decisions that benefit the 
organization as a whole. The absence of an integrated approach can 
contribute to duplication in programs and equipment that does not operate 
effectively together. 35 

GAO best practices work also emphasizes that (1) a comprehensive 
assessment of agency needs should be conducted, (2) current capabilities 
and assets should be identified to determine if and where a gap may lie 
between current and needed capabilities, and (3) a decision about how 
best to meet the identified gap should be evaluated. The approved mission 
needs statement must support the need for a project before the project can 
proceed to the acquisition phase. OMB guidance states that in creating 
capital plans, agencies should identify a performance gap between the 
existing portfolio of agency assets and the mission need that is not filled 
by the agency's asset portfolio. 36 Moreover, best practices indicate that 
investment resources should match valid requirements before approval of 
investments. 



DHS Budget Decisions for 
Major Investments Have 
Generally Not Been 
Informed by Mission 
Needs and Life-Cycle Cost 
Estimates 



The DHS investment review process calls for IRB decisions and program 
guidance regarding new investments to be reflected to the extent possible 
in the budget. The DHS budget process consists of overlapping planning, 
programming, budgeting, and execution phases that examine existing 
program funding and link funding to program performance to ensure funds 
are expended appropriately and produce the expected results and benefits 
(see fig. 3). 



io GAO-07-388. 

36 OMB, Capital Programming Guide: Supplement to Circular A- 11, Part 7, Preparation, 
Submission, and Execution of the Budget. 
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Figure 3: DHS Planning, Programming, Budgeting, and Execution Phases of the Budget Process 
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Source: DHS (data); GAO (analysis and presentation). 



Annually, components submit resource allocation proposals for major 
investments to the CFO for review in March and, in turn, resource 
allocation decisions are provided to components in July. According to 
CFO representatives, information from investment oversight reviews 
would be useful to inform investment annual resource allocation 
decisions. CFO representatives explained that the CFO sought to align 
resource allocation decisions with the IRB approvals in 2006, but this was 
not possible because of the erratic investment review meeting schedule. 
As a result, a number of CFO and CPO representatives confirmed that 
funding decisions for major investments have not been contingent upon 
the outcomes of the investment review process. 

One of the primary functions of the IRB is to review and approve level 1 
investments for formal entry into the annual budget process. However, we 
found that 18 of DHS's 57 major investments did not have an approved 
mission needs statement — a document that formally acknowledges that 
the need is justified and supported. Specifically, the statement summarizes 
the investment requirement, the mission or missions that the investment is 
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intended to support, the authority under which the investment was begun, 
and the funding source for the investment. As such, approval of the 
mission needs statement is required at the earliest stages of an investment. 
Lacking information on which major investments have validated mission 
needs, the CFO has allocated funds for major investments for which a 
capability gap has not been established. We reported in 2007 that DHS 
risked selecting investments that would not meet mission needs in the 
most cost-effective manner. 37 The 18 investments that lacked an approved 
mission needs statement accounted for more than half a billion dollars in 
estimated fiscal year 2008 appropriations (see table 4). 



"GAO-07-424. 
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Table 4: DHS Investments without a Mission Needs Statement in Fiscal Year 2008 



Dollars in millions 


Citizenship and Immigration Services (CIS) 


Customer Service Web Portal 


$15.8 


Immigration CLAIMS 3.0 


10.9 


Integrated Document Production 


31.8 


Naturalization CLAIMS 4.0 


17.7 


Verification Information System 


37.9 


Domestic Nuclear Detection Office 


Advanced Spectroscopic Portal Program 


147.5 


Cargo Advanced Automated Radiography System Active Radiography 


43.0 


Detection Systems 




Federal Emergency Management Agency (FEMA) 


Consolidated Alert and Warning System 


25.6 


Disaster Management E-Government Initiative 


12.5 


Housing Inspection Services, Inspection Contracts 


40.5 


Total Asset Visibility (Phase 1) 


33.8 


Immigration and Customs Enforcement (ICE) 


Asset Management Construction Account 


16.5 


Federal Financial Management System 


21.4 


National Protection and Program Directorate 


Infrastructure Information Collection Program 


14.2 


National Security and Emergency Preparedness 


117.6 


U.S. Computer Emergency Readiness Team 


76.6 


Office of Health Affairs 


National Bio-Surveillance Integration System 


5.3 


Transportation Security Administration (TSA) 


Federal Air Marshall Service Air to Ground Communications System and 


12.6 


Tactical Information Sharing System 




Total 


$681.2 



Source: GAO analysis of DHS data and total 2008 costs reported in DHS fiscal year 2009 capital asset plan and business case 
summaries. 



In addition, two thirds of major investment budget decisions were reached 
without a life-cycle cost estimate. A life-cycle cost estimate provides an 
exhaustive and structured accounting of all resources and associated cost 
elements required to develop, produce, deploy, and sustain a particular 
program. Life-cycle costing enhances decision making, especially in early 
planning and concept formulation of acquisition and can support 
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budgetary decisions, key decision points, milestone reviews, and 
investment decisions. GAO and OMB guidance emphasize that reliable 
cost estimates are important for program approval and continued receipt 
of annual funding. 38 DHS policy similarly provides that life-cycle cost 
estimates are essential to an effective budget process and form the basis 
for annual budget decisions. However, 39 of the 57 level 1 and level 2 
major DHS investments we reviewed did not have a life-cycle cost 
estimate. Moreover, DHS's 2007 assessment of 37 major investments also 
found investments without life-cycle cost estimates and noted poor cost 
estimating as a systemic issue. Without such estimates, DHS major 
investments are at risk of experiencing cost overruns, missed deadlines, 
and performance shortfalls. Cost increases often mean that the 
government cannot fund as many programs as intended. To begin to 
address this issue, the DHS Undersecretary for Management issued a 
memo in July 2008 initiating an effort to review and improve the credibility 
of life-cycle cost estimates for all level 1 investments prior to formal 
milestone approval. 



Lack of Portfolio Reviews 
Increases Risk of 
Duplication in DHS's Major 
Investments 



The JRC is responsible for managing the department's level 1 and level 2 
major investment portfolios and making portfolio-related 
recommendations to the IRB. Managing investments as portfolios is a 
continuous and proactive approach to allocating finite resources among an 
organization's competing initiatives in light of the relative benefits 
expected from these investments. Taking a portfolio perspective allows an 
agency to determine how its collective investments can optimally address 
its strategic goals and objectives. As part of this responsibility, the JRC is 
expected to identify crosscutting opportunities and overlapping or 
common requirements and determine how best to ensure that DHS uses its 
finite resources wisely in those areas. Specifically, the JRC reviews 
investments to identify duplicative mission capabilities and to assess 
redundancies. While a certain amount of redundancy can be beneficial, 
our prior work has found that unintended duplication indicates the 
potential for inefficiency and waste. 39 The Enterprise Architecture Board 
supports the JRC by overseeing the department's enterprise architecture 
and performing technical reviews of level 1 and level 2 IT investments. In 



GAO, Cost Assessment Guide: Best Practices for- Estimating and Managing Program 
Costs, GAO-07-1134SP (Washington, D.C.: July 2007). 

39 GAO, Managing for Results: Using the Results Act to Address Mission Fragmentation 
and Program Overlap, GAO/AIMD-97-146 (Washington, D.C.: Aug. 29, 1997). 
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2007, we reported that DHS did not have an explicit methodology and 
criteria for determining program alignment to the architecture. 40 We 
further reported that DHS policies and procedures for portfolio 
management had yet to be defined, and as a result, control of the 
department's investment portfolios was ad hoc. 

When it met regularly, the JRC played a key role in identifying several 
examples of overlapping investments, including passenger screening 
programs. Specifically, in March 2006, the JRC identified programs that 
had potential overlaps, including TSA's Secure Flight, TSA's Registered 
Traveler, and CBP's Consolidated Registered Traveler programs, yet the 
programs lacked coordination and were struggling with interoperability 
and information sharing. Because the JRC stopped meeting soon 
thereafter, DHS may have missed opportunities to follow up on these 
cases or identify further cases of potential overlap. In 2007, we reported 
that while TSA and CBP had begun coordinating efforts, they had yet to 
align their passenger prescreening programs to identify potential overlaps 
and minimize duplication. 41 We recommended that DHS take additional 
steps and make key policy and technical decisions that were necessary to 
more fully coordinate these programs. TSA and CBP have since worked 
with DHS to develop a strategy to align regulatory policies and coordinate 
efforts to facilitate consistency across their programs. 42 In another case, 
we reported that CIS's Transformation investment has been conducted in 
an ad hoc and decentralized manner, and, in certain instances, is 
duplicative with other IT investments. 43 

DHS's 2007 assessment of 37 major investments also identified potential 
overlap and duplication of effort between investments. Overall the review 
found that limited communication and coordination across components 
led to overlapping DHS programs. For example, DHS found that the CIS 
Verification Information System had potential duplication of requirements 
implementation with National Protection and Program Directorate's U.S. 



4U GAO-07-424. 

41 GAO, Aviation Security: Progress Made in Systematic Planning to Guide Key 
Investment Decisions, but More Work Remains, GAO-07-448T (Washington, D.C.: Feb. 13, 
2007). 

42 GAO, Aviation Security: Transportation Security Administration Has Strengthened 
Planning to Guide Investments in Key Aviation Security Programs, but More Work 
Remains, GAO-08-456T (Washington, D.C.: Feb. 28, 2008). 

43 GAO-07-1013R. 
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Computer Emergency Readiness Team investment. In another instance, 
DHS found the CIS Integrated Document Production investment had an 
unclear relationship to other DHS credentialing investments. 



OMB requires all agencies including DHS to submit program justification 
documents 44 for major investments to inform both quantitative decisions 
about budgetary resources consistent with the administration's program 
priorities, and qualitative assessments about whether the agency's 
programming processes are consistent with OMB policy and guidance. To 
help ensure that investments of public resources are justified and that 
public resources are wisely invested, OMB began using a Management 
Watch List in the President's fiscal year 2004 budget request as a means to 
oversee the justification for and planning of agencies' information 
technology investments. This list was derived based on a detailed review 
of each investment's Capital Asset Plan and Business Case. In addition, 
OMB has established criteria for agencies to use in designating high-risk 
projects that require special attention from oversight authorities and the 
highest levels of agency management. These projects are not necessarily at 
risk of failure, but may be on the list because of one or more of the 
following four reasons: 

• The agency has not consistently demonstrated the ability to manage 
complex projects. 

• The project has exceptionally high development, operating, or 
maintenance costs, either in absolute terms or as a percentage of the 
agency's total portfolio. 

• The project is being undertaken to correct recognized deficiencies in the 
adequate performance of an essential mission program or function of the 
agency, a component of the agency, or another organization. 

• Delay or failure of the project would introduce for the first time 
unacceptable or inadequate performance or failure of an essential mission 
function of the agency, a component of the agency, or another 
organization. 

According to DHS officials, without input from investment oversight 



OMB, Circular No. A-ll, Preparation, Submission, and Execution of the Budget 
(Washington, D.C.: Executive Office of the President, June 2006); Circular No. A-130 
Revised, Management of Federal Information Resources (Washington, D.C.: Executive 
Office of the President, Nov. 28, 2000); and Capital Programming Guide: Supplement to 
Circular A-ll, Part 7, Preparation, Submission, and Execution of the Budget. 



Limited DHS Investment 
Oversight Has Led OMB to 
Designate Many DHS 
Programs as Poorly 
Planned and Poorly 
Performing 
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reviews, a limited budget review of program justification documents prior 
to OMB submittal can be the only oversight provided for some DHS major 
investments. CFO representatives told us that in the absence of investment 
review decisions, they rely on the best available information provided by 
program managers in order to determine if funding requests are 
reasonable. As a result, major investment programs can proceed 
regardless of whether the investment has received the appropriate IRB 
review or has required acquisition documents. 

We reported that as of July 2008, 15 DHS major investments are on both 
the OMB Management Watch List and list of high-risk projects with 
shortfalls, meaning that they are both poorly planned and poorly 
performing. 45 According to DHS officials, the funding, programming, and 
budget execution process is not integrated into the requirements and 
acquisition oversight process and the DHS Undersecretary for 
Management has said that strengthening these processes is a top priority. 



The challenges DHS faces in implementing its investment review process 
are long-standing and have generally resulted in investment decisions that 
are inconsistent with established policy and oversight. Concurrent with 
this lack of oversight are acquisition programs worth billions of dollars 
with cost, schedule, and performance deficiencies. Weaknesses in some 
component management practices compound the problem leaving 
investments with little to no scrutiny or review. While the department's 
process has been under revision since 2005, DHS has begun new efforts to 
clarify and better adhere to the investment review process. Without 
validating mission needs, requirements, and program baselines including 
costs, as well as identifying duplicative efforts and monitoring progress, 
DHS cannot appropriately manage investments and inform the budget 
process. Until DHS aligns oversight of major investments with annual 
budget decisions, the department is at risk of failing to invest in programs 
that maximize resources to address capability gaps and ultimately help 
meet critical mission needs. 



Recommendations for 
Executive Action 



We recommend that the Secretary of Homeland Security direct the 
Undersecretary for Management to take the following five actions to better 
ensure the investment review process is fully implemented and adhered to: 



°GAO-08-1051T. 
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• Establish a mechanism to identify and track on a regular basis new and 
ongoing major investments and ensure compliance with actions called for 
by investment oversight boards. 

• Reinstate the JRC or establish another departmental joint requirements 
oversight board to review and approve acquisition requirements and 
assess potential duplication of effort. 

• Ensure investment decisions are transparent and documented as required. 

• Ensure that budget decisions are informed by the results of investment 
reviews including IRB approved acquisition information and life cycle cost 
estimates. 

• Identify and align sufficient management resources to implement oversight 
reviews in a timely manner throughout the investment life cycle. 

To improve investment management, we recommend that the Secretary of 
Homeland Security direct component heads to take the following two 
actions: 

• Ensure that components have established processes to manage major 
investments consistent with departmental policies. 

• Establish a mechanism to ensure major investments comply with 
established component and departmental investment review policy 
standards. 



We provided a draft of this report to DHS for review and comment. In 
written comments, the department generally concurred with our findings 
and recommendations, citing actions taken and efforts under way to 
improve the investment review process. The department's comments are 
reprinted in appendix II. DHS components also provided technical 
comments which we incorporated as appropriate and where supporting 
documentation was provided. In addition, several DHS components and 
offices reported additional progress since the time of our review to ensure 
their major investments comply with departmental policies. 

DHS is taking important steps to strengthen investment management and 
oversight. After being under revision since 2005, DHS issued a new interim 
management directive on November 7, 2008, that outlines a revised 
acquisition and investment review process. DHS also cited two new offices 
within the Chief Procurement Office that were established to provide 
better acquisition management and oversight; recently completed program 
reviews; and plans to revise training, standards, and certification 
processes for program managers. While many of these efforts are noted in 



Agency Comments 
and Our Evaluation 
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our report, investment management and oversight has been an ongoing 
challenge since the department was established, and continued progress 
and successful implementation of these recent efforts will require 
sustained leadership and management attention. 

DHS stated that the new interim acquisition management directive will 
address many of our recommendations; however, our work has found that 
DHS has not fully implemented similar steps in the past. For example, in 
response to our first recommendation, to establish a mechanism to 
identify and track on a regular basis new and ongoing major investments 
and ensure compliance with actions called for by investment review board 
decisions, DHS's new interim directive requires major programs to 
participate in an acquisition reporting process. While DHS is in the process 
of implementing a Next Generation Periodic Reporting System, it is too 
soon to tell whether this system will be successfully implemented. DHS's 
first-generation periodic reporting system was never fully implemented, 
making it difficult for the department to track and enforce investment 
decisions. 

In response to our second recommendation, to reinstate the JRC or 
establish another departmental joint requirements oversight board to 
review and approve acquisition requirements and assess potential 
duplication of effort, DHS stated it has already developed a new Strategic 
Requirements Review process to assess capability needs and gaps; 
completed pilots; and briefed senior leadership. According to DHS's new 
interim acquisition management directive, the results of this process are to 
be validated by the JRC, which is still in the process of being established 
and for which no timeline was provided. Further, as we found in this 
report, when the JRC was previously established in 2004, it was never fully 
implemented due to a lack of senior management officials' involvement. 

In response to our third recommendation, that DHS ensure investment 
decisions are transparent and documented as required, DHS stated that its 
new interim acquisition management directive already implements this by 
requiring acquisition documentation for each acquisition decision event 
and capturing decisions and actions in acquisition decision 
memorandums. DHS also reported that it has conducted eight Acquisition 
Review Board meetings with documented Acquisition Decision 
Memorandums. While this progress is notable, our work has found that 
since 2004, DHS's investment review board has not been able to effectively 
carry out its oversight responsibilities and keep pace with investments 
requiring review due to a lack of senior officials' involvement as well as 
limited monitoring and resources. It is too soon to tell whether DHS's 
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latest efforts will be sustained to ensure investments are consistently 
reviewed as needed. 

Regarding our fourth recommendation, that the department ensure budget 
decisions are informed by the results of investment reviews, the new 
interim management directive creates a link between the budget and 
requirements processes and describes interfaces with other investment 
processes. While this process is more clearly established in the new 
directive, its implementation will be evidenced in the documents produced 
during upcoming budget cycles. We found in this report that the previous 
investment review process also highlighted links to the budget and other 
investment processes, yet the results of oversight reviews did not 
consistently inform budget decisions. 

In response to our fifth recommendation, to identify and align sufficient 
management resources to implement oversight reviews in a timely manner 
throughout the investment life cycle, DHS stated that it has partially 
implemented the recommendation by establishing a senior executive-led 
Acquisition Program Management Division within the Office of the CPO 
and plans to increase staffing from its current level of 12 experienced 
acquisition and program management specialists to 58 by the end of fiscal 
year 2010. Creating a new division to manage oversight reviews is a 
positive step; however, we have found that DHS has been challenged to 
provide sufficient resources to support its acquisition oversight function 
and the CPO's office has had difficulty filling vacancies in the past. 

Regarding our two recommendations to improve investment management 
at the component level, DHS noted that the new interim management 
directive requires components to align their internal policies and 
procedures by the end of the third quarter of fiscal year (June) 2009. In 
addition, DHS plans to issue another management directive which will 
instruct component heads to create component acquisition executives in 
their organizations to be responsible for the implementation of 
management and oversight of component acquisition processes. If fully 
implemented, these steps should help to ensure that components have 
established processes to manage major investments. DHS further noted 
that establishment of the Acquisition Program Management Division, the 
new interim acquisition management directive, reestablishment of the 
acquisition review process, and other steps work together to ensure major 
investments comply with established component and departmental 
investment review policy standards. To implement this recommendation, 
the new component acquisition executives will need to be in place and 
successfully implement and ensure compliance with the new processes. 
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DHS will continue to face ongoing challenges to implementing an effective 
investment review process identified in this report and highlighted in the 
department's Integrated Strategy for High Risk Management. For example, 
consistent with our findings, the strategy cites challenges to ensuring 
availability of leadership to conduct investment reviews; timely collection 
and assessment of program data; and sufficient staff to support the 
investment review process. Sustained leadership focus will be even more 
critical to implement changes and maintain progress on acquisition 
management challenges as the department undergoes its first executive 
branch transition in 2009. 



As agreed with your offices, unless you publicly announce the contents of 
this report, we plan no further distribution for 30 days from the report 
date. At that time, we will send copies of this report to interested 
congressional committees and the Secretary of Homeland Security. We 
will also make copies available to others upon request. In addition, the 
report will be available at no charge on GAO's Web site at 
http://www.gao.gov. 

If you or your staff have questions regarding this report, please contact me 
at (202) 512-4841 or huttonj@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. Principal contributors to this report were Amelia Shachoy, 
Assistant Director; William Russell; Laura Holliday; Nicole Harkin; Patrick 
Peterson; Karen Sloan; Marie Ahearn; and Kenneth Patton. 

Sincerely yours, 




John Hutton, Director 

Acquisition and Sourcing Management 
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Appendix I: Scope and Methodology 



Our objectives were to: (1) evaluate DHS's implementation of the 
investment review process, and (2) assess DHS's integration of the 
investment review and budget processes to ensure major investments 
fulfill mission needs. 

To assess how the investment review process has been implemented, we 
reviewed the DHS Investment Review Process management directive and 
corresponding handbook to determine which major investments required 
DHS review. In doing so, we focused on determining such key factors as 
how frequently major investments required oversight reviews and what 
documents such as mission need statements and acquisition program 
baselines are required to be approved by DHS executive review boards. 
We included in our analyses 57 level 1 and level 2 1 investments that DHS 
identified for fiscal year 2008. We determined the level of oversight 
provided to 48 of these major investments — those that required 
department-level review from fiscal year 2004 through the second quarter 
of fiscal year 2008. We also interviewed representatives of the Chief 
Procurement Office (CPO), Chief Financial Office (CFO), and Chief 
Information Office as well as nine DHS components and offices that 
manage major investments. We then collected investment review and 
program documents for each major investment and compared the 
information to investment review policy requirements. We also reviewed 
acquisition decision memorandums from fiscal year 2004 through the 
second quarter of fiscal year 2008. Based on the decision memos and 
investment information, we determined how many investments had been 
reviewed in accordance with DHS policy from fiscal year 2004 through the 
second quarter of fiscal year 2008. We also reviewed prior GAO reports on 
DHS programs as well as commercial best practices for acquisition. We 
reviewed DHS documents such as interim policy memos and guidance and 
interviewed CPO staff regarding planned revisions to the investment 
review process. We also compared our findings with a 2007 DHS internal 
assessment of 37 major investments. In addition, we reviewed available 
DHS periodic reports on major investments as well as component 
operational status reports to identify instances of cost growth, schedule 
slips, and performance shortfalls for major investments and to determine 
the status of program manager certification in fiscal year 2007 through the 
second quarter of fiscal year 2008. This information is self-reported by 



^HS major investments include those with a total acquisition cost of $50 million or above 
for noninformation technology investments or life-cycle costs greater than $100 million for 
information technology investments. 
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Appendix I: Scope and Methodology 



DHS major program offices and all programs did not always provide 
complete information, and we did not independently verify information in 
these reports. 

To assess the integration of investment review and the budget process, we 
reviewed DHS management directives for the investment review and the 
planning, programming, budgeting, and execution process as well as 
corresponding guidance. We also interviewed representatives from the 
Chief Procurement Office and Chief Financial Office to discuss how the 
processes have been integrated since 2004. We used investment data and 
acquisition documents from each major investment program to determine 
which had required life-cycle cost estimates and other documents such as 
a validated mission need statements. We also reviewed fiscal year 2009 
DHS budget justification submissions to OMB. We compared DHS budget 
practices with GAO and Office of Management and Budget (OMB) 
guidance on capital programming principles. In addition, we reviewed 
relevant GAO reports. 

We conducted this performance audit from September 2007 until 
November 2008 in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
believe that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 
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Appendix II: Comments from the Department 
of Homeland Security 



t'.S. Dc|Hn1n»M uf llumcliinil Sccnrily 
Washington, DC 20528 



NOV -7 2008 




| Homeland 
F Security 



Mr. John Hutton 

Director, Acquisition and Sourcing Management 
Government Accovmtability Office 
Washington, D.C. 20548 

Dear Mr. Hutton 

Thank you for the opportunity to review Draft Report GAO-09-29, Department of Homeland 
Security: Billions Invested in Major Programs Lack Appropriate Oversight. 

The Department of Homeland Security (DHS) and the Office of the Chief Procurement Officer 
(OCPO) generally concur with and have already implemented GAO recommendations, as detailed 
below. During the past year, for example, DHS: 

1) Re-engineered the process for management of the Department's Acquisition and 
Investment review process. New Acquisition Directive (102-01), accompanied by an 
Instruction (102-01-001), replaces MD 1400 and lays out a comprehensive acquisition 
lifecycle framework and acquisition process. Supporting the instruction are appendices 
providing detailed information on critical acquisition related products and processes. 
These will be implemented as Department Acquisition policy at the beginning of 
November 2008; 

2) Established the Acquisition Program Management Division and the Cost Analysis Division 
within OCPO. These divisions provide departmental policy, processes and procedures for 
DHS Acquisition Programs, as well as both oversight of and assistance to our acquisition 
programs. They are currently staffed with 12 experienced Acquisition and Program 
management specialists, with support from the Defense Acquisition University and the 
Homeland Security Institute. Current plans are to increase staffing to a total of 58 by the 
endofFY-10; 

3) Completed 37 quick-look program reviews, two Independent Review Team level program 
reviews, and eight Acquisition Review Boards (ARB, formerly Investment Review Boards, 
IRBs). These ARBs are issue-focused and documented via Acquisition Decision 
Memorandums (ADMs). The revised process provides much improved rigor and focus to 
this vital Departmental oversight function, and are supported by the Chief Information 
Officer's (CIO) Enterprise Architecture Board (EAB) and the Chief Administrative 
Officer's (CAO) DHS Asset Review Boards (DARB). Both boards provide technical 
expertise and assistance where needed. As of the end of FY-08, eight ARBs have been 
conducted, with eight more scheduled through December 2008; and 
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of Homeland Security 



4) CPO has also established revised training, standards, and certification processes for 
program managers (MD 782) and will implement standards for test and evaluation, 
systems engineering, acquisition logistics, and cost analysis by the end of the CY. 

The following is the Departmental response to the recommendations outlined in the draft report: 

1) Recommendation: Establish a mechanism to identify and track on a regular basis 
new and ongoing major investments and ensure compliance with actions called for 
by investment oversight boards. 

Status: Recommendation already implemented. The DHS Chief Information Office 
(CIO), in collaboration with the DHS Chief Procurement Office (CPO), has reengineered the 
acquisition program periodic reporting process and is implementing a new system, Next 
Generation Periodic Reporting System (nPRS), after completing a successful pilot period. In 
addition to tracking cost, schedule, and performance attributes of a program's Acquisition 
Program Baseline (APB), the system tracks Acquisition Decision Memorandum (ADM) 
action items that result from Acquisition Review Boards (ARBs), as well as other pertinent 
information. 

2) Recommendation: Reinstate the JRC or establish another departmental joint 
requirements oversight board to review and approve acquisition requirements and 
assess potential duplication of effort. 

Status: The DHS Office of Policy has already developed a new Strategic Requirements 
Review Process to assess the Departmental capability needs and gaps. This process feeds the 
yearly Integrated Planning Guidance (IPG). Pilots of the new process have been completed 
and the results briefed to senior DHS management. 

3) Recommendation: Ensure investment decisions are transparent and documented as 
required. 

Status: Recommendation already implemented. DHS has implemented a new 
Acquisition Management Directive, which identifies the required acquisition documentation 
for each Acquisition Decision Event (ADE). The documentation is reviewed by the 
Acquisition Review Team (ART), under the direction of the Acquisition Program 
Management Division (APMD), prior to each ADE. This identifies focused issues that form 
the basis for the ARB review. Immediately following the ARB, the decisions and actions are 
captured in an Acquisition Decision Memorandum (ADM) which is staffed and signed by the 
Acquisition Decision Authority (ADA). The new periodic reporting system mentioned above 
tracks the acquisition program documentation including the ADMs. A status report is 
periodically distributed to Department, Component, and program office leadership. 

4) Recommendation: Ensure that budget decisions are informed by the results of 
investment reviews including 1RB approved acquisition information and lifecycle 
cost estimates. 
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Status: Recommendation already implemented. The new Acquisition Directive and the 
accompanying Instruction address the interfacing "touch points" with the Department's 
budgeting and requirements decision processes. For example, a Mission Need Statement 
(MNS) is required for Resource Allocation Proposals (RAPs). Additionally, the Directive 
and Instruction describe the interfaces with other processes (e.g. OMB Capital Planning and 
Investment Control (CPIC), DHS Enterprise Architecture Board, and DHS Asset Review 
Board) 

5) Recommendation: Identify and align sufficient management resources to implement 
oversight reviews in a timely manner throughout the investment lifecycle. 

Status: Partially implemented. DHS has established a Senior Executive-led Acquisition 
Program Management Division (APMD) within the Office of the Chief Procurement Officer. 
Additionally, DHS has established a Cost Analysis Division (CAD) also within the Office of 
the Chief Procurement Officer to provide cost estimating guidance and to provide oversight 
of program cost estimates. These divisions are currently staffed with 12 experienced 
Acquisition and Program management specialists, with support from the Defense Acquisition 
University and the Homeland Security Institute. Current plans are to increase staffing to a 
total of 58 by the end of FY-10. 

6) To improve investment management, we recommend that the Secretary of 
Homeland Security direct component heads to take the following two actions: 

a. Ensure that components have established processes to manage major 
investments consistent with departmental policies. 

Status: Recommendation will be fully implemented by end of 3Q09 in the new 
acquisition management directive plus the updated Acquisition Line of Business Directive, 
which require Components to align their internal policies and procedures. Additionally, 
Component Heads are instructed to create a Component Acquisition Executive (CAE) 
position in their organizations. This individual will be nominated by the Component Head, 
approved by USM, and is responsible for the implementation of management and oversight 
of their Component acquisition processes. In addition to leading their Components through 
the Acquisition Review Process for Level 1 and Levei 2 programs at the Department Level, 
they will also be responsible for executing the Acquisition Review Process for Level 3 
programs within their Component. 

b) Recommendation: Establish a mechanism to ensure major investments comply 
with established component and departmental investment review policy 
standards. 

Status: Recommendation implemented: The establishment of APMD, the new 
Acquisition Directive and Instruction, the reestablishment of the ARB process, the 
integration of the principal Department decision processes, as well as the other acquisition 
initiatives underway (e.g. the new periodic reporting system, the Component Acquisition 
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Executive) work together to ensure compliance with the Department's and Component's 
acquisition policies. 

We thank you again for the opportunity to review the report and provide comments. 



Sincerely, 




Chief Procurement Officer 
Department of Homeland Security 



Page 41 



GAO-09-29 DHS Major Investment Oversight 



Appendix III: Key Acquisition Documents by 
Major Investment 



Mission needs statements, operational requirements documents, and 
acquisition program baselines establish capability gaps, requirements 
needed to address those gaps, and cost, schedule, and performance 
parameters, respectively. Of the 57 DHS level 1 and 2 investments, 34 were 
in an acquisition phase that required all three documents; 27 either did not 
develop the document or only provided an unapproved draft of one or 
more of these documents (see table 5). Some major investment programs 
provided acquisition program baselines approved at the component level 
that were submitted but did not receive department review and approval. 



Table 5: Documentation for Investments in Phases That Require All Key Acquisition 
Documents 



Investment 


Mission 
Needs 
Statements 


Operational 
Requirements 
Document 


Acquisition 
Program 
Baseline 


Analysis and Operations 


Common Operational Picture 


• 


• 


O 


Homeland Security Information System 


• 


• 


O 


Chief Human Capital Office 


HR IT 


• 


• 


o 


Chief Information Officer Office 


Infrastructure 


• 


O 


o 


Citizenship and Immigration Services 


Customer Service Web Portal 


O 


O 


o 


Integrated Document Production 


O 


o 


o 


Transformation 


• 


o 


o 


Coast Guard 


Integrated Deepwater System 




o 


• 


Nationwide Automatic Identification System 






• 


Rescue 21 






• 


Response Boat Medium 






• 


Customs and Border Protection 


Strategic Air Plan 






o 


Automated Commercial Environment 






• 


Border Patrol Facilities 






o 


Secure Border Initiative net 






o 


Secure Freight Initiative 






o 


Western Hemisphere Travel Initiative 




o 


o 



Domestic Nuclear Detection Office 
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Major Investment 



Investment 


Mission 
Needs 
Statements 


Operational 
Requirements 
Document 


Acquisition 
Program 
Baseline 


Advanced Spectroscopic Portal (ASP) 
Program 


O 


O 


O 


Federal Emergency Management Agency 


Disaster Management E-Government 
Initiative 


O 


O 


O 


Immigration and Customs Enforcement 


Asset Management Construction Account 


o 


o 


o 


Automation and Modernization 


• 


• 


o 


Detention and Removal Modernization 


• 


o 


o 


Student and Exchange Visitor Information 
System 


• 


• 


o 


National Protection and Program Directorate 


Critical Infrastructure Warning Information 
Network 


• 


• 


o 


Infrastructure Information Collection 
Program 


o 


o 


o 


U.S. Computer Emergency Readiness 
Team 


o 


o 


o 


U.S. Visitor and Immigrant Status Indicator 
Technology 


• 


• 


• 


Office of Health Affairs 


National Bio-Surveillance Integration 
System 


o 


o 


o 


Science and Technology Directorate 


National Bio-defense Analysis and 
Countermeasures Center Facility 


• 


• 


• 


Transportation Security Administration 


Electronic Baggage Screening Program 




o 


• 


Mission Scheduling and Notification 
System 




o 


o 


Passenger Screening Program 




• 


• 


Secure Flight 




o 


• 


Transportation Worker Identification 
Credentialing 




• 


o 


Total Investments Missing at Least One Document 


27 





Source: GAO analysis of DHS data reported as of March 2008. 



• Indicates that the program provided: a mission needs statement, an operational requirements 
document, or a department-approved acquisition program baseline. 

O Indicates the program did not provide: a mission needs statement, an operational requirements 
document, or a department-approved acquisition program baseline. 
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Appendix IV: Department of Homeland 
Security Investments Reviewed by GAO 



Program 



Description 



Analysis and Operations 



Common Operational Picture Provides fusion and visualization of information to create timely and accurate situational 

awareness reports for the Secretary of Homeland Security, the White House, and other users 
to detect, deter, and prevent terrorist activities 

Homeland Security Information System Facilitates information sharing and collaboration across DHS and its partners; enables real- 
time sharing of threat information for tactical first-responder support; and supports decision 
making in a real time secure environment. 

Citizenship and Immigration Services 



Immigration CLAIMS 3.0 



Naturalization CLAIMS 4.0 



Customer Service Web Portal 



Integrated Document Production 



Transformation 



Verification Information System 



Coast Guard 



Designed to support processing of applications and petitions, capture fees and provide funds 
control, provide case status and support, and record the results of the adjudication of each 
application and petition. 

Established to provide: naturalization processing, interface with associated databases, 
improved accuracy, and more timely and accurate information to the public. 

Provides resources for all web development and maintenance activities. Includes web content 
management, development of web based transactions with Citizenship and Immigration 
Services customers and staff, web site maintenance, and web site hosting. 

Provides integrated card production system printers' hardware and software, operational 
contract support, and facilities required to print secure cards granting immigration privileges or 
benefits to applicants. 

A system to allow all new immigration benefits applications and petitions to be filed 
electronically through a Citizenship and Immigration Services Internet web-based portal. 
Citizenship and Immigration Services will have a more comprehensive view of the customer 
and any potentially fraudulent transactions; improved audit functionality and record 
management; better resource management; and increased sharing of information within DHS 
and with other agency partners such as Justice and State. 

Supports the Systematic Alien Verification for Entitlements Program by providing automated 
status-verification information to federal, state, and local benefit-granting and entitlement 
agencies, and the E-Verify program by allowing participating employers to verify their new 
employees are authorized to work in the United States. 



Integrated Deepwater System 



Aims to replace and modernize most of the Coast Guard's fleet of offshore cutters, boats, 
aircraft, and command and control systems over 25 years. 



Marine Information for Safety and 
Law Enforcement 



Nationwide Automatic Identification 
System 

Rescue 21 



Supports incident response, contingency planning, violation reporting and processing, vessel 
casualty investigation and analysis, vessel documentation, user fee collection, analysis of 
mission performance, monitoring of program effectiveness. 

Will implement a nationwide system for tracking and exchanging information with identification 
system equipped vessels operating in or approaching U.S. waters to improve homeland 
security and enhance Coast Guard and DHS operational mission performance. 

Command, control and communication system that improves mission execution in coastal 
zones. Essential to meet Search and Rescue program goals. Results in improved response to 
distress calls and better coordination and interoperability with other government agencies and 
first responders. 
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Appendix IV: Department of Homeland 
Security Investments Reviewed by GAO 



Program 


Description 


Response Boat Medium 


Intended to replace the aging 41 -foot utility boats and other large non-standard boats with 




assets more capable of meeting all of the Coast Guard multi-mission operational 




requirements. 


Vessel Logistics System 


A collection of systems or applications used to provide vessel logistics information 




management capacity to the Coast Guard. 



Customs and Border Protection (CBP) 



Automated Commercial Environment 



Automated Targeting System 
Maintenance 



Border Patrol Facilities 



Consolidated Trusted Traveler 
Program 



Web-based import and export system that consolidates seven systems into one portal. It will 
provide advanced technology and information to decide, before a shipment reaches U.S. 
borders, what cargo should be targeted, and what cargo should be expedited. 

Intranet-based enforcement and decision support tool that is the cornerstone for all CBP 
targeting efforts. CBP uses the system to improve the collection, use, analysis, and 
dissemination of information to target, identify, and prevent potential terrorists and terrorist 
weapons from entering the United States and identify other violations and violators of U.S. 
law. 

Will build additional facilities to meet the needs of CBP's expansion of its Border Patrol agent 
staffing. The recent addition of more agents and technology into enforcement activities has 
exceeded existing facility capacity. 

Framework used by trusted traveler programs for registering enrollees and performing 
identification and validation using automated systems. 



Non-Intrusive Inspection Systems 
Program 

Secure Border Initiative net 



Secure Freight Initiative 



Strategic Air Plan 



Traveler Enforcement Compliance 
System Modernization 



Technologies support the interdiction of weapons of mass destruction and effect, contraband, 
and illegal aliens being smuggled across the United States border, while having a minimal 
impact on the flow of legitimate commerce. 

Aims to integrate technology and tactical infrastructure into a comprehensive border security 
suite. This system will improve agent ability to respond to illegal activity and help DHS 
manage, control, and secure the border. 

Phase I will deploy next-generation technology and integrated systems to scan maritime 
containers for radiation or other special nuclear material. 

Will help develop an integrated and coordinated air and marine force to detect, interdict and 
prevent acts of terrorism arising from unlawful movement of people, illegal drugs and other 
contraband toward or across the borders of the United States. The goal is to modernize and 
standardize the existing CBP air and marine fleets and will require a specific number of 
primary and secondary air and marine locations and additional personnel to meet growing 
needs. 

Consolidated business case between CBP and ICE that will modernize: subject record 
"watch list" processing, inspection support at ports of entry, as well as case management. 



Western Hemisphere Travel Initiative 



DHS 



Will fulfill the regulatory requirement to develop and implement a system to verify that U.S. 
and non-U. S. citizens present an authorized travel document denoting identity and 
citizenship when entering the United States. 



Homeland Secure Data Network 



Provides a state-of-the-art, flexible, secure through security certification and accreditation, 
classified, collateral, integrated, and centrally managed enterprise wide-area network. 
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Appendix IV: Department of Homeland 
Security Investments Reviewed by GAO 



Program 



Description 



DHS Chief Information Office 



Infrastructure Transformation 



DHS Chief Financial Office 



Includes the consolidated DHS IT infrastructure environments which support the cross- 
organizational missions of protecting the homeland from a myriad of threats. These IT 
infrastructure investments are critical to providing a foundation in which information can be 
disseminated and shared across all DHS components, including external customers and 
intelligence partners, in a secure, cost effective, and efficient manner. 



Financial Transformation & Systems 
Consolidation 



DHS Chief Human Capital Office 



Aims to achieve compliant financial management services and optimize financial 
management operations across the diverse systems cobbled together in 2003 when DHS 
was created from 22 agencies and over 200,000 people. 



Human Resource Information 
Technology 



Aims to improve and consolidate DHS's vast array of payroll and personnel systems. It will 
provide DHS with a common flexible suite of human resource business systems. 



Domestic Nuclear Detection Office 



Advanced Spectroscopic Portal 
Program 



Its systems will develop, procure, and deploy current and next generation passive cargo 
portal units at the nation's borders. 



Cargo Advanced Automated 
Radiography System - Active 
Radiography Detection Systems 

Joint Analysis Center 



Will deliver an advanced imaging system that will automatically detect high density material, 
detecting shielding that could be used to hide special nuclear material and highly enriched 
uranium or weapons grade plutonium. The system aims to improve throughput rates 
providing more effective scanning of a higher portion of cargo at the nation's ports of entry. 

An integrated system to collect, analyze and distribute status, alarms, alert, and spectral data 
from all radiation portal monitors and equipment deployed at the Federal, State, Local, Tribal 
and international levels. 



Federal Emergency Management Agency (FEMA) 



Consolidated Alert & Warning System 



Disaster Management E-Government 
Initiative 



Provides the president, governors, mayors, tribal leadership with the ability to speak to the 
American people in the event of a national emergency by providing an integrated, survivable, 
all-hazards public alert and warning system that leverages all available technologies and 
transmission paths. It will also provide "situation awareness" to the public and leadership at 
multiple levels of government in an emergency. 

Provides information exchange delivery mechanisms through a portal for disaster 
information, an information exchange backbone, and data interoperability standards. 



Flood Map Modernization 



Established a technology-based, cost effective process for updating, validating, and 
distributing flood risk data and digitalized flood maps throughout the Nation. 



Housing Inspection Services, 
Inspection Contracts 



Provides inspection staff and logistics at a moment's notice to any Presidentially declared 
disaster. The state of readiness is 24 hours a day, 7 days a week, 365 days a year. 



Total Asset Visibility (Phase I) 



Provides FEMA, emergency support function partners, and state decision makers with 
visibility of disaster relief assets and shipments to help ensure that the right assets are 
delivered in the right quantities to the right locations at the right time. 



Immigration and Customs Enforcement (ICE) 



Asset Management Construction 
Account 



Aims to satisfy three fundamental requirements: 1) house a growing population of illegal 
aliens, 2) provide appropriate conditions of confinement and 3) maintain its facility 
infrastructure. These requirements must be met through a series of design and build actions 
that begin with establishing facility infrastructure, continue with establishing detention 
capacity and culminate in building secure housing facilities. 
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Appendix IV: Department of Homeland 
Security Investments Reviewed by GAO 



Program 



Description 



Automation and Modernization 



IT modernization and automation initiative that serves as the principal ICE program to: 
enhance ICE's technology foundation, maximize workforce productivity, secure the IT 
environment, and improve information sharing across ICE and DHS. 



Detention and Removal Modernization 



Will provide operations management and field personnel the technical tools necessary to 
apprehend, detain, and remove illegal aliens in a cost-effective manner. 



Federal Financial Management System Provides ICE with core accounting capabilities 



Student and Exchange Visitor 
Information System 



Web-based system that manages data on schools, program sponsors, foreign students, 
exchange visitors, and their dependents during their approved participation in the U.S. 
education system so that only legitimate visitors enter the US. 



National Protection and Program Directorate 



Critical infrastructure Warning 
Information Network 



Infrastructure Information Collection 
Program 

National Security and Emergency 
Preparedness Priority 
Telecommunications Service 



US CERT 



US Visitor and Immigrant Status 
Indicator Technology 



Survivable network connecting DHS with sectors that restore the infrastructure: electricity, IT 
and communications; states' homeland security advisors; and sector-specific agencies and 
resources for each critical infrastructure sector. 

Collects, catalogs and maintains standardized and quantifiable, risk-related infrastructure 
information to enable the execution of national risk management and for prioritizing the data 
for use by DHS partners. 

Aims to provide specially designed telecommunications services to the national security and 
emergency preparedness user community during natural or man-made disasters when 
conventional communications services are ineffective. These telecommunication services are 
used to coordinate response and recovery efforts and, if needed, to assist with facilitating the 
reconstitution of the government. 

Combines the capabilities of four existing investments to form a fully integrated IT system 
that will help fulfill the organization's mission to collect, analyze, and respond to cyber 
security threats and vulnerabilities pursuant to its mission and authorities. 

Program is to collect, maintain, and share information, including biometric identifiers, on 
foreign nationals to determine whether an individual (1) should be prohibited from entering 
the United States; (2) can receive, extend, change, or adjust immigration status; (3) has 
overstayed or otherwise violated the terms of admission; (4) should be apprehended or 
detained for law enforcement action; or (5) needs special protection/attention (e.g., 
refugees). The vision of the US-VISIT Program is to deploy end-to-end management of data 
on foreign nationals covering their interactions with U.S. immigration and border 
management officials before they enter, when they enter, while they are in the U. S., and 
when they exit. 



Office of Health Affairs 



National Bio-Surveillance Integration 
System 



Information Technology investment with a mission of providing early detection and 
characterization of a biological attack on the United States. 



Science and Technology Directorate 



National Bio and Agro-Defense Facility Infrastructure investment to support the Science and Technology Chemical and Biological 

Division program, which provides the technologies and systems needed to anticipate, deter, 
detect, mitigate, and recover from possible biological attacks on this nation's population, 
agriculture or infrastructure. The program operates laboratories and biological detection 
systems and conducts research. 
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Appendix IV: Department of Homeland 
Security Investments Reviewed by GAO 



Program Description 

National Biodefense Analysis and Infrastructure investment to support the Science and Technology Chemical and Biological 
Countermeasures Center Facility Division program, a key component in implementing the Presidents National Strategy for 

Homeland Security by addressing the need for substantial research into relevant biological 
and medical sciences to better detect, and mitigate the consequences of biological attacks 
and to conduct risk assessments. The program operates laboratories and biological detection 
systems and conducts research. 



Transportation Security Administration (TSA) 

Electronic Baggage Screening Implements a national checked-baggage screening system to protect against criminal and 

Program terrorist threats, while minimizing transportation industry and traveling public burdens. 



FAMS Air to Ground Communications 
System and Tactical Information 
Sharing System 



An airborne communication system of systems (air-to-ground, ground-to-air, air-to-air and 
intra-cabin) that will give Air Marshall and other Law Enforcement Officers access to wireless 
communications and the ability to share information while in flight. 



FAMS Mission Scheduling and 
Notification System 



System to manage the schedules of federal air marshals given the flights available (-25,000 
per day) and the complexities of last minute changes due to flight cancellations. 



Hazmat Threat Assessment Program 



Leverages existing intelligence data to perform threat assessments on commercial truck 
drivers who transport hazardous materials to determine threat status to transportation 
security. 



Passenger Screening Program 



Secure Flight 



Transportation Worker Identification 
Credentialing 

TSA Operating Platform 



Provides the resources required to deploy and maintain passenger screening and carry-on 
baggage screening equipment and processes at approximately 451 airports nationwide in 
order to minimize the risk of injury or death of people or damage of property due to hostile 
acts of terrorism. 

Will strengthen the security of the nation's transportation systems by creating, implementing, 
and operating a threat-based watch list matching capability for approximately 250 million 
domestic air carrier passengers per year. 

Will improve security by establishing a system-wide common secure biometric credential, 
used by all transportation modes, for personnel requiring unescorted physical and/or logical 
access to secure areas of the trans system. 

Provides common environment for hosting applications; integrated data infrastructure; 
content; and a collection of shared services. 



Source: DHS information. 



(120684) 
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GAO's Mission 



Obtaining Copies of 
GAO Reports and 
Testimony 



The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 
is through GAO's Web site (www.gao.gov). Each weekday afternoon, GAO 
posts on its Web site newly released reports, testimony, and 
correspondence. To have GAO e-mail you a list of newly posted products, 
go to www.gao.gov and select "E-mail Updates." 



Order by Phone 



To Report Fraud, 
Waste, and Abuse in 
Federal Programs 

Congressional 
Relations 



The price of each GAO publication reflects GAO's actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black and 
white. Pricing and ordering information is posted on GAO's Web site, 
http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 
E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 
U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, DC 20548 



Public Affairs 



Chuck Young, Managing Director, youngcl@gao.gov, (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, DC 20548 



